System and method for cross-authoritative configuration management

ABSTRACT

A system and method for cross-authoritative, user-based network configuration management is provided. Users log-in to a network using any device coupled to the network, and an identity manager may provide the user with a custom computing environment by verifying the user&#39;s identity and identifying content, assignments, and other configuration information associated with the user. For instance, the identity manager may retrieve a unique identifier assigned to the user, query one or more authoritative source domains based on the unique identifier, and deliver a computing environment assigned to the user. By seamlessly integrating multiple authoritative sources, administrators can make assignments to users across multiple authoritative source domains, and queries to the sources will always be up-to-date without having to perform synchronization processes.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.11/878,290, entitled “System and Method for Cross-AuthoritativeConfiguration Management,” filed Jul. 23, 2007, the contents of whichare hereby incorporated by reference in their entirety.

FIELD OF THE INVENTION

The invention relates to user-based network configuration managementusing a plurality of integrated authoritative sources.

BACKGROUND OF THE INVENTION

Managing a network infrastructure often entails accounting for user,device, or other identities in order to control access rights (e.g.,permissions or authorizations to access certain network resources), userassignments (e.g., applications or policies assigned to a user), orotherwise manage a network based on users. As such, many networkimplementations incorporate a form of identity management in order tosimplify user management processes. For example, identity managementsolutions often include an authoritative source (e.g., a directoryservice) that identifies a network's resources, users' rights to accessthe resources, and application or policy assignments for specific usersor devices, among other things. As a network infrastructure grows andchanges, however, effective user-based management often becomesdifficult, particularly when heterogeneous systems include differentauthoritative sources or identity management products.

For example, various groups, departments, or other classes of networkusers or devices may have different requirements resulting in differentauthoritative sources being implemented within the network. In anotherexample, a network may be upgraded or migrated to a new authoritativesource, but an administrator may prefer to manage new users with the newsource and preserve a previous authoritative source for existing users.Although there can be many reasons for using multiple authoritativesources, existing systems often cannot provide seamless integration andinteroperability among the various authoritative sources. For example,many existing integration efforts focus on use of synchronizationmodules that dredge authoritative sources, discover users, and build asearchable database. This type of system suffers from various drawbacks,including a lack of a consistent way to create identity-awareapplications, while shielding programmers from underlying differences inthe authoritative sources. Moreover, synchronization modules may onlysearch authoritative sources at periodic intervals, or upon request, orin other ways that do not provide real-time integration andinteroperability. As such, users requiring immediate access to resourcesmay be restricted from accessing critical resources until completion ofthe synchronization process, potentially causing unnecessary delays, ordecreases in productivity, among other problems.

Existing systems suffer from these and other problems.

SUMMARY OF THE INVENTION

According to various aspects of the invention, a system and method forcross-authoritative configuration management may address these and otherdrawbacks of existing systems. The invention may be used to managenetwork configurations using multiple authoritative sources, enablingfull interoperability and seamless integration with any number ofauthoritative sources (e.g., using an identity manager having nativesupport for the authoritative sources). As such, devices, software,policies, group memberships, or other network resources can be directlyassigned to a network user based on the user's identity, regardless ofwhere the user accesses the network, and regardless of whichauthoritative source or sources include the user's identity information.

According to various aspects of the invention, an identity manager maybe coupled to a network, and may provide a single point of control forconfiguring or otherwise managing one or more users across a pluralityof authoritative sources. Users may log-in to the network using anysuitable device coupled to the network, and the identity manager mayprovide the user with a computing environment customized for the user,regardless of which device the user employs. For instance, upon the userlogging in, the identity manager may verify the user's identity byretrieving a unique identifier assigned to the user. The identitymanager may then query one or more authoritative source domains based onthe user's unique identifier to identify a computing environment (e.g.,assignments, applications, desktop configurations, policies, groupmemberships, content, etc.) associated with the user. Each user may beprovided with their own customized computing environment, which can betailored to specific needs of the user, a group to which the userbelongs, a business role of the user, or otherwise, as will be apparent.As such, users may be free from being limited to using any specificdesktop, workstation, laptop, or other device. Moreover, by directlyintegrating with the authoritative sources, the identity manager mayprovide native, full, and immediate real-time integration with anydirectory or other source of managed users. Whenever a change occurs inany of the authoritative sources, subsequent queries will immediatelyreflect the change with no need for synchronization. Further, byseamlessly integrating multiple authoritative sources, administratorscan make assignments to users across multiple authoritative sourcedomains (e.g., a group of users can include a first set of users from afirst authoritative source, a second set of users from a secondauthoritative source, etc.).

According to various aspects of the invention, integrated authoritativesources enables real-time, identity-based management having simpleservice delivery and accurate user device configurations. Using thisdynamic approach, desktop changes, application assignments, or otheraspects of a computing environment can be recognized immediatelywhenever a change occurs to a network user's account, across pluralauthoritative sources, without limitation. As such, a networkinfrastructure can be implemented to manage user desktops, devices, orother computing environments based on any number of network identities,including any suitable combination of user business role, location,group membership, or other characteristics. Accordingly, applications,content, and other information technology resources can be deliveredbased on personal needs of each user. From a single point of control,administrators can assign applications to users, regardless of whichauthoritative source domain (or combination of source domains) the usersreside within. Existing authoritative sources can be integratedseamlessly (e.g., via a web services architecture) without requiring anychanges to source schemas. Further, the sources can be integratedwithout specialized directories or authoritative sources (e.g., asearchable LDAP abstraction), or synchronization of passwords orinformation between directories. Rather, the identity manager may storeinformation relating to globally unique identifiers assigned todirectory objects by the integrated authoritative sources. Theidentifiers may be used by the identity manager to formulate direct,lightweight queries to the authoritative source itself. All otherinformation, including assignments between content, users, or devices,among other things, can be stored in the authoritative source andretrieved via the unique identifiers. For example, the identity managercan look up tables (e.g., Structured Query Language tables) to determinewhat content to deliver to users, which devices the users currently run,or other information, and the content can then be delivered to theappropriate place to users having proper access rights. Further, byusing multiple directories or authoritative sources, assignments can bemanaged across multiple trees, domains, or other source configurations.For example, user groups can be created containing users from differentsources (e.g., mixing users from different trees, domains, or othersource configurations within a single group).

Other objects and advantages of the invention will be apparent to thoseskilled in the art based on the following drawings and detaileddescription.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates an exemplary system for managing networkconfigurations based on multiple authoritative sources according tovarious aspects of the invention.

FIGS. 2 a-b illustrates exemplary methods for establishing a singlepoint of control over multiple authoritative sources according tovarious aspects of the invention.

FIG. 3 illustrates an exemplary method for providing assignments tousers and/or devices based on multiple authoritative sources accordingto various aspects of the invention.

DETAILED DESCRIPTION

Referring to FIG. 1, an exemplary system 100 for managing networkconfigurations based on multiple authoritative sources is illustratedaccording to various aspects of the invention. System 100 may be usedfor, among other things, directly assigning devices, software, policies,group memberships, or other network resources to a user based on anidentity of the user. Further, as shown in FIG. 1, system 100 can fullyinteroperate and seamlessly integrate with any number of authoritativesources 130 a-n, for example, by way of an identity manager 110including native support for the authoritative sources 130 a-n. Forexample, in various implementations, identity manager 110 may be NovellZENworks® Configuration Management, and the authoritative sources 130a-n may include Novell® eDirectory™, Microsoft Active Directory, or anyother authoritative source that can be used to manage users (e.g.,PeopleSoft DB, OpenLDAP, etc.).

According to various aspects of the invention, the identity manager 110may be coupled to a network 140, and may provide a single point ofcontrol for configuring or otherwise managing one or more users. A usermay log-in to the network 140 using any of a plurality of devices 150a-n coupled to the network 140, and identity manager 110 may provide theuser with a customized computing environment regardless of which device150 the user employs to log in to the network 140. For instance, uponthe user logging in, identity manager 110 may verify the user's identityby retrieving a unique identifier assigned to the user from a datarepository 120. Identity manager 110 may query one or more ofauthoritative source domains 130 a-n based on the user's uniqueidentifier in order to identify a computing environment (e.g.,assignments, applications, desktop configurations, policies, groupmemberships, content, etc.), validate a user, retrieve user attributes(e.g., e-mail address, name, location, etc.), or perform other usermanagement tasks. For example, each user may be provided with their owncustomized computing environment, which can be tailored to specificneeds of the user, a group to which the user belongs, a business role ofthe user, or otherwise, as will be apparent. In another example, theuser's unique identifier can be used to authenticate or otherwisevalidate the user by incorporating credentials provided by the user onlog-in (e.g., user name, password, etc.) into a validation call thatalso includes the user's unique identifier, and the validation call maybe passed to a directory or other authoritative source to validate theuser.

As such, the user may be provided with the customized computingenvironment regardless of where the user logs in to the network 140,freeing users from being tethered to any specific desktop, workstation,laptop, or other device. Moreover, by directly integrating with theauthoritative sources 150 a-n, identity manager 110 may provide native,full, and immediate real-time integration with any directory or othersource of managed users. Thus, a user can be managed using one or moredifferent domains, directories, or other authoritative sources (e.g., auser's assignments, attributes, etc. could be managed in an ActiveDirectory domain, while a device being used by the user could be managedin a different authoritative source). Whenever a change occurs in any ofthe authoritative sources 150 a-n, subsequent queries to the changedauthoritative source 150 may immediately reflect the change withouthaving to synchronize a database. Further still, by seamlesslyintegrating multiple authoritative sources 150 a-n, administrators maymake assignments to users across multiple authoritative source domains150 a-n. For instance, in one example, an administrator may create agroup having a first set of users managed in a first authoritativesource 130 a, a second set of users managed in a second authoritativesource 130 b, or otherwise. Thus, identity manager 110 provides a singlepoint of control for administrators to control what users (or groups ofusers) receive which assignments based on user identities managed withinplural authoritative sources 150 a-n.

Referring to FIGS. 2 a-b, an exemplary method for establishing a singlepoint of control over multiple authoritative sources is illustratedaccording to various aspects of the invention. By establishing thesingle point of control (e.g., in an identity manager coupled to theauthoritative sources), software, policies, configurations, groupmemberships, or other assignments can be applied to users managed underany of the authoritative sources, or across the authoritative sources,or otherwise, as will be apparent. For instance, in an operation 205,multiple authoritative sources may be integrated with an identitymanager to provide the single point of control over all of the sources.When initially linking the authoritative sources, the identity managermay query the sources in operation 205 (e.g., via a LightweightDirectory Access Protocol query), and user identity information may becaptured from the sources in an operation 210.

For example, an authoritative source may assign unique identifiers(e.g., globally unique identifiers) to objects (e.g., directory objects)managed in the authoritative source. As such, in an operation 215,authoritative source information may be captured by retrieving theassigned unique identifiers from the authoritative sources. The uniqueidentifiers can relate to users, devices, content (e.g., applications orpolicies), or other information for entities managed by theauthoritative sources. Thereafter, in an operation 220, the uniqueidentifiers may be stored in a table and subsequently used to configureor manage a user's computing environment.

As such, network users can be managed using any suitable authoritativesource or combination thereof. Administrators can therefore manageapplications, policies, group assignments, or other informationtechnology resources intended for a user, a group of users, or otherwisewithout having to perform user account replication or synchronization.For example, as illustrated in FIG. 2 b, an administrator can manageuser assignments directly in one or more authoritative sources in anoperation 225. Assignments may be made in the authoritative source basedon a user, a container, a group, or other configuration, as will beapparent. Once the assignment has been made, the authoritative sourcemay generate a unique identifier for the assignment in an operation 230,and the unique identifier may be added to the source table in anoperation 235. As will be apparent, assignments can include softwareassignments, policy assignments, group membership assignments, or otherassignments. For example, an administrator could create a group tocontain a plurality of users, and once the users have been added to thegroup in the authoritative source, the administrator can makeassignments to the entire group. Moreover, the users within the groupcould be from any number of authoritative source domains, directorytrees, or otherwise, and the assignment may be validly applied acrossall of the sources.

Thus, the identity manager can be linked to various user uniqueidentifiers, as well as user groups and containers in the authoritativesources. Administrators can make assignments to individual users, groupsof users, containers of users, or in other ways, and a user will receiveany assignments applied to groups, containers, sub-groups orsub-containers, or other abstractions to which the user belongs. Assuch, whenever the identity manager requires information from adirectory object in a linked authoritative source, the identity managerwill query the source with an appropriate unique identifier to recoverthe data. For instance, as illustrated in FIG. 3, a user may log in tothe identity manager from any device coupled to the network. The user'slog in may be processed in an operation 305, and the user's identity,group memberships, and other identification characteristics may beverified in an operation 310. For example, the identity manager mayretrieve a unique identifier assigned to the user from the source table,and one or more authoritative sources may be queried in an operation 315based on the identifier. The user's group assignments, softwareassignments, desktop configurations, policy assignments, or otherinformation technology resources may be identified by the authoritativesource, and an operation 320 may then include delivering the identifiedassignments to any suitable device from where the user has logged in.

Employing features described herein, network administrators may easilyenable real-time, identity-based management having simple servicedelivery and accurate user device configurations. Using this dynamicapproach, desktop changes, application assignments, or other aspects ofa computing environment can be recognized immediately whenever a changeoccurs to a network user's account, across plural authoritative sources,without limitation. As such, a network infrastructure can be implementedto manage user desktops, devices, or other computing environments basedon any number of network identities, including any suitable combinationof user business role, location, group membership, or othercharacteristics. Accordingly, applications, content, and otherinformation technology resources can be delivered based on personalneeds of each user. From a single point of control, administrators canassign applications to users, regardless of which authoritative sourcedomain (or combination of source domains) the users reside within.Existing authoritative sources can be integrated seamlessly (e.g., via aweb services architecture) without requiring any changes to the sources'schemas. Further, the sources can be integrated without requiring aspecialized directory or authoritative source (e.g., a searchable LDAPabstraction) or synchronization of passwords or information betweendirectories.

Information stored at the identity manager can be limited to theglobally unique identifiers assigned to directory objects by theauthoritative sources, which may be used to formulate direct,lightweight queries to the authoritative source itself. Otherinformation, including assignments between content, users, and devices,among other things, can be stored in the authoritative sources, tablesor databases associated with the identity manager, or otherwise, and theidentity manager may retrieve such assignments, associations, and otherinformation via the unique identifiers. For example, a user's rights toapplications, content, or other rights can be identified by the identitymanager looking up tables (e.g., Structured Query Language tables)according to a user's unique identifier to determine what content todeliver to users, which devices the users currently run, or otherinformation, and the content can then be delivered to the appropriateplace to users having proper access rights. Further, by using multipledirectories or authoritative sources, assignments can be managed acrossmultiple trees, domains, or other source configurations. User groups canbe created containing users from different sources (e.g., mixing usersfrom different trees, domains, or other source configurations within asingle group). As such, by storing assignments in the identity managerrather than the authoritative sources, the identity manager can providea single point of control for managing user-based configurations usingany suitable combination of the authoritative sources.

Implementations of the invention may be made in hardware, firmware,software, or any combination thereof. The invention may also beimplemented as instructions stored on a machine-readable medium, whichmay be read and executed by one or more processors. A machine-readablemedium may include any mechanism for storing or transmitting informationin a form readable by a machine (e.g., a computing device). For example,a machine-readable storage medium may include read only memory, randomaccess memory, magnetic disk storage media, optical storage media, flashmemory devices, and others, and a machine-readable transmission mediamay include forms of propagated signals, such as carrier waves, infraredsignals, digital signals, and others. Further, firmware, software,routines, or instructions may be described in the above disclosure interms of specific exemplary aspects and implementations of theinvention, and performing certain actions. However, those skilled in theart will recognize that such descriptions are merely for convenience andthat such actions in fact result from computing devices, processors,controllers, or other devices executing the firmware, software,routines, or instructions.

Aspects and implementations may be described as including a particularfeature, structure, or characteristic, but every aspect orimplementation may not necessarily include the particular feature,structure, or characteristic. Further, when a particular feature,structure, or characteristic is described in connection with an aspector implementation, it is understood that it is within the knowledge ofone skilled in the art to effect such feature, structure, orcharacteristic in connection with other aspects or implementationswhether or not explicitly described. Thus, various changes andmodifications may be made, without departing from the scope and spiritof the invention. The specification and drawings are to be regarded asexemplary only, and the scope of the invention is to be determinedsolely by the appended claims.

1. A method for cross-authoritative configuration management,comprising: integrating a plurality of authoritative sources with anidentity manager that natively supports schemas used in the plurality ofauthoritative sources, wherein the identity manager integrated with theplurality of authoritative sources operates on a processor and providesa single point of control for managing access rights across theplurality of authoritative sources; receiving, at the identity manageroperating on the processor, a request to access a resource on a networkfrom a device in communication with the identity manager, wherein therequest to access the resource on the network includes one or morecredentials provided by at least one user managed across the pluralityof authoritative sources; determining the access rights for the at leastone user across the plurality of authoritative sources, whereindetermining the access rights for the at least one user includescapturing identifiers for any directory objects assigned to the at leastone user in the plurality of authoritative sources and retrieving theaccess rights for the at least one user from the directory objectsassigned to the at least one user in the plurality of authoritativesources; and providing the at least one user with access to therequested resource in response to determining that the access rightsretrieved from the directory objects assigned to the at least one userin the plurality of authoritative sources indicate that the at least oneuser has permission to access the requested resource.
 2. The method ofclaim 1, wherein integrating the plurality of authoritative sources withthe identity manager further includes associating the identifiers forthe directory objects assigned to the at least one user in the pluralityof authoritative sources with a globally unique identifier assigned tothe at least one user.
 3. The method of claim 1, wherein the directoryobjects assigned to the at least one user in the plurality ofauthoritative sources define the access rights for the at least one useracross the plurality of authoritative sources.
 4. The method of claim 3,wherein the directory objects assigned to the at least one user in theplurality of authoritative sources further define the access rights forone or more groups that include the at least one user or one or morecontainers that include the at least one user.
 5. The method of claim 1,further comprising: detecting, by the identity manager operating on theprocessor, a change to one or more of the directory objects assigned tothe at least one user in the plurality of authoritative sources; andupdating, by the identity manager operating on the processor, theidentifiers for the one or more changed directory objects.
 6. A systemfor cross-authoritative configuration management, comprising: aplurality of authoritative sources integrated with an identity managerthat natively supports schemas used in the plurality of authoritativesources, wherein the identity manager integrated with the plurality ofauthoritative sources provides a single point of control for managingaccess rights across the plurality of authoritative sources; and one ormore processors that execute the identity manager, wherein the one ormore processors that execute the identity manager are configured to:receive a request to access a resource on a network from a device incommunication with the identity manager, wherein the request to accessthe resource on the network includes one or more credentials provided byat least one user managed across the plurality of authoritative sources;determine the access rights for the at least one user across theplurality of authoritative sources, wherein determining the accessrights for the at least one user includes capturing identifiers for anydirectory objects assigned to the at least one user in the plurality ofauthoritative sources and retrieving the access rights for the at leastone user from the directory objects assigned to the at least one user inthe plurality of authoritative sources; and provide the at least oneuser with access to the requested resource in response to determiningthat the access rights retrieved from the directory objects assigned tothe at least one user in the plurality of authoritative sources indicatethat the at least one user has permission to access the requestedresource.
 7. The system of claim 6, wherein the one or more processorsthat execute the identity manager are further configured to associatethe identifiers for the directory objects assigned to the at least oneuser in the plurality of authoritative sources with a globally uniqueidentifier assigned to the at least one user.
 8. The system of claim 6,wherein the directory objects assigned to the at least one user in theplurality of authoritative sources define the access rights for the atleast one user across the plurality of authoritative sources.
 9. Thesystem of claim 8, wherein the directory objects assigned to the atleast one user in the plurality of authoritative sources further definethe access rights for one or more groups that include the at least oneuser or one or more containers that include the at least one user. 10.The system of claim 6, wherein the one or more processors that executethe identity manager are further configured to: detect a change to oneor more of the directory objects assigned to the at least one user inthe plurality of authoritative sources; and update the identifiers forthe one or more changed directory objects.